Microsoft Graphics Component EUVD-2026-100373

Exploitation requires a local user to open or render an attacker-supplied file (image/document) processed by the Microsoft Graphics Component - this user-interaction requirement (UI:R) is the primary limiting factor and means it cannot be triggered remotely without victim action. No authentication is required of the attacker (PR:N), and no non-default configuration is needed since the graphics component is loaded by default across Windows; the attack vector is local (AV:L), so the malicious content must reach and be processed on the target host rather than being exploitable directly over a network service. Successful code execution runs in the context of the user who opened the file, so a low-privilege victim limits immediate impact to that account absent a separate privilege-escalation chain.

This is a genuine patch-priority issue despite not being the maximum-severity class. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local-vector flaw requiring user interaction but no prior authentication, yielding full confidentiality, integrity, and availability impact - the classic profile of a file-parsing memory-corruption bug in a core OS graphics library. Note an apparent tension worth flagging: the vector sets PR:N (unauthenticated) yet the description says 'unauthorized attacker ... locally,' meaning the attacker needs no credentials but DOES need to deliver content that a local user opens or renders (UI:R) - so 'local' here means attack vector, not pre-existing local access. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no evidence of active exploitation or weaponization; risk is currently driven by the ubiquity of the affected component and the historically high exploitation rate of Windows graphics/GDI parsing bugs rather than by any confirmed in-the-wild signal. SSVC-style read: exploitation = none observed, automatable = no (requires user interaction), technical impact = total. Prioritize for standard-to-expedited patching given the component's near-universal deployment, but there is no data indicating emergency out-of-band response is required.

An attacker crafts a malicious image or document containing a specially formed graphics object and delivers it via email, web page, or file share; when a user opens or previews the file, the Microsoft Graphics Component mishandles the heap allocation, overflowing a buffer and allowing arbitrary code execution in the user's context. Exploitation requires that local user interaction (UI:R) to trigger rendering. No public exploit code was identified in the provided data.